Re: [PATCH nft] netfilter: nft_inner: Fix IPv6 inner_thoff desync

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 5/10/26 3:19 PM, Yizhou Zhao wrote:
> In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr()
> correctly computes the transport header offset traversing all extension headers,
> but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes),
> which only accounts for the IPv6 base header. This creates a desync between
> inner_thoff (wrong — points to extension header start) and l4proto (correct
>   — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall
> bypass. This issue was found and reproduced with the assistance of GLM 5.1 from
> Z.ai, and exists up to Linux 7.1, affecting stable versions from Linux 6.2.
> 

I don't think there is need to mention the model here. Please use the 
Assisted-by tag instead.

> File: net/netfilter/nft_inner.c
> Function: nft_inner_parse_l2l3()
> 
> ```c
> thoff = nhoff;
> l4proto = ipv6_find_hdr(pkt->skb, &thoff, -1, &fragoff, &fh_flags);
> if (l4proto < 0 || thoff > U16_MAX)
>      return -1;
> if (fragoff == 0) {
>      thoff = nhoff + sizeof(_ip6h);  // BUG: overwrites correct thoff
>      ctx->inner_thoff = thoff;        // stores WRONG offset
>      ctx->l4proto = l4proto;
> }
> ```
> 

I do not think this is relevant in the commit message.

> For comparison, the normal (non-inner) IPv6 path correctly preserves
> ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures
> that ipv6_find_hdr()’s calculated transport header offset is preserved,
> thereby fixing the desynchronization.
> 

The solution makes sense to me. Thanks!

> Fixes: 3a07327d10a09 ("netfilter: nft_inner: support for inner tunnel header matching")

Please stick to a 12 characters long commit hash. Make sure that 
checkpatch.pl script passes.

> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
> Reported-by: Xuewei Feng <fengxw06@126.com>
> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
> Reported-by: GLM 5.1 from Z.ai

This isn't correct. It should be Assisted-by tag instead.

Thanks,
Fernando.

> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> ---
>   net/netfilter/nft_inner.c | 1 -
>   1 file changed, 1 deletion(-)
> 
> diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
> index c4569d4b9..1b3e7a976 100644
> --- a/net/netfilter/nft_inner.c
> +++ b/net/netfilter/nft_inner.c
> @@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
>   			return -1;
>   
>   		if (fragoff == 0) {
> -			thoff = nhoff + sizeof(_ip6h);
>   			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
>   			ctx->inner_thoff = thoff;
>   			ctx->l4proto = l4proto;